mipjz

mipjz copied to clipboard

There is one SSRF vulnerability that can get some sensitive information

1

Vulnerability location：`app/setting/controller/ApiAdminDomainSettings.php`：  The problem arises in line 28——39： ```php $ch = curl_init(); $options = array( CURLOPT_URL => $api, CURLOPT_POST => true, CURLOPT_RETURNTRANSFER => true, CURLOPT_POSTFIELDS => implode("\n", $urls), CURLOPT_HTTPHEADER...

Q1ngShan

sansanyun

Bumps [symfony/http-foundation](https://github.com/symfony/http-foundation) from 4.3.2 to 4.4.1. Changelog *Sourced from [symfony/http-foundation's changelog](https://github.com/symfony/http-foundation/blob/master/CHANGELOG.md).* > CHANGELOG > ========= > > 5.1.0 > ----- > > * Deprecate `Response::create()`, `JsonResponse::create()`, > `RedirectResponse::create()`, and `StreamedResponse::create()`...

dependabot[bot]

Bumps [symfony/mime](https://github.com/symfony/mime) from 4.3.2 to 4.4.1. Changelog *Sourced from [symfony/mime's changelog](https://github.com/symfony/mime/blob/master/CHANGELOG.md).* > CHANGELOG > ========= > > 4.4.0 > ----- > > * [BC BREAK] Removed `NamedAddress` (`Address` now supports...

dependabot[bot]

This is a stored XSS which allows attacker to insert javascript code into database. When user see the message, attacker is able to steal user's cookie. **Filename** /app/widget/controller/ApiAdminWidgetPages.php **Code** ```php...

Q1ngShan

### After the administrator logs in, accessing the following two links can add an administrator user **Poc address**:https://github.com/sp1d3r/swf_json_csrf 1、**Add a user:** http://[Attack domain]/read.html?jsonData={%22groupId%22:1,%22username%22:%22admin123%22,%22password%22:%220192023a7bbd73250516f069df18b500%22,%22rpassword%22:%220192023a7bbd73250516f069df18b500%22}&php_url=http://[Attack domain]/test.php&endpoint=http://[Target domain]/index.php?s=/user/ApiAdminUser/itemAdd 2、**Promote user privileges to administrator...

5huai

There is a cross site scripting (XSS) vulnerability exists in mipjz v5.0.5

1

[Vulnerability Description] Cross SIte Scripting (XSS) vulnerability exists in mipjz v5.0.5, attackers can execute arbitrary code via the article description field from /article/ApiAdminArticle/itemAdd. [Vulnerability Type] Cross Site Scripting (XSS) [Vendor...

sma11new

[Vulnerability Description] Cross SIte Scripting (XSS) vulnerability exists in mipjz v5.0.5, attackers can execute arbitrary code via the tag category name field from categoryAdd. [Vulnerability Type] Cross Site Scripting (XSS)...

sma11new

Vulnerability product: mipjz Vulnerability version: 5.0.5 Source code link: https://github.com/sansanyun/mipjz/archive/refs/heads/master.zip Vulnerability details: In the push method of the mipjz\app\tag\controller\ApiAdminTag.php file, the value of the postAddress parameter that was not processed...

LvZCh

Vulnerability product: mipjz Vulnerability version: 5.0.5 Source code link: https://github.com/sansanyun/mipjz/archive/refs/heads/master.zip Vulnerability details: In the mipPost method of the mipjz\app\setting\controller\ApiAdminTool.php file, the value of the postAddress parameter that was not processed...

LvZCh